Skip to content

Commit f7d1d2c

Browse files
author
David Wertenteil
committed
update wstrigger
1 parent cee035e commit f7d1d2c

12 files changed

+73
-75
lines changed

build/Dockerfile

+3-2
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,5 @@
11
FROM golang:1.18-alpine as builder
22

3-
ENV RELEASE=$image_version
4-
53
ENV GO111MODULE=
64

75
ENV CGO_ENABLED=0
@@ -22,4 +20,7 @@ WORKDIR /home/armo/
2220

2321
COPY --from=builder /work/build/trigger /usr/bin/trigger
2422

23+
ARG image_version
24+
ENV RELEASE=$image_version
25+
2526
ENTRYPOINT ["trigger"]

go.mod

+1-2
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,7 @@ require (
88
github.com/armosec/cluster-notifier-api-go v0.0.3
99
github.com/armosec/k8s-interface v0.0.70
1010
github.com/armosec/logger-go v0.0.6
11-
github.com/armosec/opa-utils v0.0.135
11+
github.com/armosec/opa-utils v0.0.136
1212
github.com/armosec/utils-go v0.0.5
1313
github.com/armosec/utils-k8s-go v0.0.7
1414
github.com/docker/docker v20.10.14+incompatible
@@ -17,7 +17,6 @@ require (
1717
github.com/google/uuid v1.3.0
1818
github.com/gorilla/mux v1.8.0
1919
github.com/gorilla/websocket v1.5.0
20-
github.com/mitchellh/mapstructure v1.5.0
2120
github.com/stretchr/testify v1.7.1
2221
golang.org/x/net v0.0.0-20220425223048-2871e0cb64e4
2322
golang.org/x/sync v0.0.0-20210220032951-036812b2e83c

go.sum

+2-4
Original file line numberDiff line numberDiff line change
@@ -146,8 +146,8 @@ github.com/armosec/k8s-interface v0.0.70 h1:NU3UIaNl7H3hsRecwggiaQbZXTwXtOKg3GOB
146146
github.com/armosec/k8s-interface v0.0.70/go.mod h1:8NX4xWXh8mwW7QyZdZea1czNdM2azCK9BbUNmiZYXW0=
147147
github.com/armosec/logger-go v0.0.6 h1:V8iMCC/XQ7Af88F/k3uWuDQskgLHUY5MXI5L1fMoPU8=
148148
github.com/armosec/logger-go v0.0.6/go.mod h1:ZnocpQc+z6phNJSLVfXgHcOW4rg4NCO70ApmF0Y7W6w=
149-
github.com/armosec/opa-utils v0.0.135 h1:7JMHGKMD13XWwwd4g11tw6T9C4BRPifDiqdeDJEz638=
150-
github.com/armosec/opa-utils v0.0.135/go.mod h1:mCFQzz4E227f7V2jQVQ9XCivkNNK3UWCTaZ0HE5rBWk=
149+
github.com/armosec/opa-utils v0.0.136 h1:WOflXgweEUZAbLwyB18x8cbIftGhp2M2UngGxIvQEPY=
150+
github.com/armosec/opa-utils v0.0.136/go.mod h1:mCFQzz4E227f7V2jQVQ9XCivkNNK3UWCTaZ0HE5rBWk=
151151
github.com/armosec/rbac-utils v0.0.14 h1:CKYKcgqJEXWF2Hen/B1pVGtS3nDAG1wp9dDv6oNtq90=
152152
github.com/armosec/rbac-utils v0.0.14/go.mod h1:Ex/IdGWhGv9HZq6Hs8N/ApzCKSIvpNe/ETqDfnuyah0=
153153
github.com/armosec/utils-go v0.0.5 h1:+pfZirWrOvfqvVYlL7OG1wMQD4T4YMwC78zzosB+mlQ=
@@ -742,8 +742,6 @@ github.com/mitchellh/go-testing-interface v1.0.0/go.mod h1:kRemZodwjscx+RGhAo8eI
742742
github.com/mitchellh/mapstructure v0.0.0-20160808181253-ca63d7c062ee/go.mod h1:FVVH3fgwuzCH5S8UJGiWEs2h04kUh9fWfEaFds41c1Y=
743743
github.com/mitchellh/mapstructure v1.1.2/go.mod h1:FVVH3fgwuzCH5S8UJGiWEs2h04kUh9fWfEaFds41c1Y=
744744
github.com/mitchellh/mapstructure v1.4.3/go.mod h1:bFUtVrKA4DC2yAKiSyO/QUcy7e+RRV2QTWOzhPopBRo=
745-
github.com/mitchellh/mapstructure v1.5.0 h1:jeMsZIYE/09sWLaz43PL7Gy6RuMjD2eJVyuac5Z2hdY=
746-
github.com/mitchellh/mapstructure v1.5.0/go.mod h1:bFUtVrKA4DC2yAKiSyO/QUcy7e+RRV2QTWOzhPopBRo=
747745
github.com/mitchellh/osext v0.0.0-20151018003038-5e2d6d41470f/go.mod h1:OkQIRizQZAeMln+1tSwduZz7+Af5oFlKirV/MSYes2A=
748746
github.com/moby/locker v1.0.1/go.mod h1:S7SDdo5zpBK84bzzVlKr2V0hz+7x9hWbYC/kq7oQppc=
749747
github.com/moby/spdystream v0.2.0/go.mod h1:f7i0iNDQJ059oMTcWxx8MA/zKFIuD/lY+0GqbN2Wy8c=

main.go

+2-13
Original file line numberDiff line numberDiff line change
@@ -2,14 +2,13 @@ package main
22

33
import (
44
"flag"
5-
"fmt"
6-
"io/ioutil"
75
"k8s-ca-websocket/cautils"
86
"k8s-ca-websocket/mainhandler"
97
"k8s-ca-websocket/notificationhandler"
108
"k8s-ca-websocket/notificationhandler/safemode"
119
"k8s-ca-websocket/restapihandler"
1210
"k8s-ca-websocket/websocket"
11+
"os"
1312

1413
"github.com/armosec/armoapi-go/apis"
1514
"github.com/armosec/k8s-interface/k8sinterface"
@@ -82,15 +81,5 @@ func main() {
8281
}
8382

8483
func displayBuildTag() {
85-
imageVersion := "local build"
86-
dat, err := ioutil.ReadFile("./build_number.txt")
87-
if err == nil {
88-
imageVersion = string(dat)
89-
} else {
90-
dat, err = ioutil.ReadFile("./build_date.txt")
91-
if err == nil {
92-
imageVersion = fmt.Sprintf("%s, date: %s", imageVersion, string(dat))
93-
}
94-
}
95-
glog.Infof("Image version: %s", imageVersion)
84+
glog.Infof("Image version: %s", os.Getenv("RELEASE"))
9685
}

mainhandler/handlerequests.go

+1-3
Original file line numberDiff line numberDiff line change
@@ -181,10 +181,8 @@ func (actionHandler *ActionHandler) runCommand(sessionObj *cautils.SessionObj) e
181181
return actionHandler.scanWorkload(sessionObj)
182182
case apis.SCAN_REGISTRY:
183183
return actionHandler.scanRegistry(sessionObj)
184-
case string(apis.TypeRunKubescape):
184+
case string(apis.TypeRunKubescape), string(apis.TypeRunKubescapeJob):
185185
return actionHandler.kubescapeScan()
186-
case string(apis.TypeRunKubescapeJob): // deprecated
187-
return actionHandler.runKubescapeJob()
188186
case string(apis.TypeSetKubescapeCronJob):
189187
return actionHandler.setKubescapeCronJob()
190188
case string(apis.TypeUpdateKubescapeCronJob):

mainhandler/imageregistryhandler.go

+4-8
Original file line numberDiff line numberDiff line change
@@ -2,10 +2,10 @@ package mainhandler
22

33
import (
44
"context"
5+
"fmt"
56

67
"github.com/armosec/k8s-interface/cloudsupport"
78
"github.com/docker/docker/api/types"
8-
"github.com/golang/glog"
99
"github.com/google/go-containerregistry/pkg/authn"
1010
containerregistry "github.com/google/go-containerregistry/pkg/name"
1111
"github.com/google/go-containerregistry/pkg/v1/remote"
@@ -39,26 +39,22 @@ func (regCreds *registryCreds) Authorization() (*authn.AuthConfig, error) {
3939
if cloudsupport.CheckIsECRImage(regCreds.RegistryName) {
4040
username, password, err = cloudsupport.GetLoginDetailsForECR(regCreds.RegistryName)
4141
if err != nil {
42-
glog.Infof("ECR get Authorization failed with err %v", err)
43-
return nil, err
42+
return nil, fmt.Errorf("ECR get Authorization failed with err %v", err.Error())
4443
}
4544
*regCreds.auth = types.AuthConfig{Username: username, Password: password}
4645
} else if cloudsupport.CheckIsGCRImage(regCreds.RegistryName + "/") {
4746
username, password, err = cloudsupport.GetLoginDetailsForGCR(regCreds.RegistryName)
4847
if err != nil {
49-
glog.Infof("GCR get Authorization failed with err %v", err)
50-
return nil, err
48+
return nil, fmt.Errorf("GCR get Authorization failed with err %v", err.Error())
5149
}
5250
*regCreds.auth = types.AuthConfig{Username: username, Password: password}
5351
} else if cloudsupport.CheckIsACRImage(regCreds.RegistryName + "/") {
5452
username, password, err = cloudsupport.GetLoginDetailsForAzurCR(regCreds.RegistryName)
5553
if err != nil {
56-
glog.Infof("GCR get Authorization failed with err %v", err)
57-
return nil, err
54+
return nil, fmt.Errorf("ACR get Authorization failed with err %v", err.Error())
5855
}
5956
*regCreds.auth = types.AuthConfig{Username: username, Password: password}
6057
} else {
61-
glog.Infof("try to get images with no creds from regustry %v", regCreds.RegistryName)
6258
return &authn.AuthConfig{}, nil
6359
}
6460

mainhandler/kubescapehandler.go

-1
Original file line numberDiff line numberDiff line change
@@ -104,7 +104,6 @@ func (actionHandler *ActionHandler) kubescapeScan() error {
104104
if err != nil {
105105
return err
106106
}
107-
108107
resp, err := httputils.HttpPost(http.DefaultClient, getKubescapeV1ScanURL().String(), nil, body)
109108
if err != nil {
110109
return err

mainhandler/kubescapehandlerhelper.go

+2-5
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,6 @@ import (
1313
"github.com/armosec/armoapi-go/apis"
1414
"github.com/armosec/k8s-interface/k8sinterface"
1515
utilsmetav1 "github.com/armosec/opa-utils/httpserver/meta/v1"
16-
"github.com/armosec/utils-go/boolutils"
1716
v1 "k8s.io/api/batch/v1"
1817
corev1 "k8s.io/api/core/v1"
1918
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
@@ -48,7 +47,7 @@ func getKubescapeV1ScanRequest(args map[string]interface{}) (*utilsmetav1.PostSc
4847
// validate
4948
postScanRequest := &utilsmetav1.PostScanRequest{}
5049
if err := json.Unmarshal(scanV1Bytes, postScanRequest); err != nil {
51-
return nil, fmt.Errorf("failed to convert request to v1/scan object")
50+
return nil, fmt.Errorf("failed to convert request to v1/scan object, reason: %s", err.Error())
5251
}
5352

5453
return postScanRequest, nil
@@ -70,7 +69,7 @@ func readKubescapeV1ScanResponse(resp *http.Response) (*utilsmetav1.Response, er
7069
}
7170

7271
if err := json.Unmarshal(bodyBytes, response); err != nil {
73-
return nil, fmt.Errorf("failed to convert response object")
72+
return nil, fmt.Errorf("failed to convert response object, reason: %s", err.Error())
7473
}
7574

7675
return response, nil
@@ -136,11 +135,9 @@ func convertRulesToRequest(args map[string]interface{}) error {
136135
}
137136

138137
postScanRequest := &utilsmetav1.PostScanRequest{}
139-
postScanRequest.Submit = boolutils.BoolPointer(true)
140138
for i := range rulesList {
141139
postScanRequest.TargetType = utilsapisv1.NotificationPolicyKind(rulesList[i].Kind)
142140
postScanRequest.TargetNames = append(postScanRequest.TargetNames, rulesList[i].Name)
143-
144141
}
145142
args[cautils.KubescapeScanV1] = postScanRequest
146143
return nil

mainhandler/vulnscan.go

+4-4
Original file line numberDiff line numberDiff line change
@@ -162,7 +162,7 @@ func (actionHandler *ActionHandler) scanWorkload(sessionObj *cautils.SessionObj)
162162
errs := ""
163163
containers, err := getWorkloadImages(actionHandler.k8sAPI, actionHandler.wlid)
164164
if err != nil {
165-
return fmt.Errorf("cant get workloads from k8s, wlid: %s, reason: %s", actionHandler.wlid, err.Error())
165+
return fmt.Errorf("failed to get workloads from k8s, wlid: %s, reason: %s", actionHandler.wlid, err.Error())
166166
}
167167

168168
// we want running pod in order to have the image hash
@@ -182,9 +182,9 @@ func (actionHandler *ActionHandler) scanWorkload(sessionObj *cautils.SessionObj)
182182

183183
glog.Infof("wlid: %s, container: %s, image: %s, jobIDs: %s/%s/%s", websocketScanCommand.Wlid, websocketScanCommand.ContainerName, websocketScanCommand.ImageTag, actionHandler.reporter.GetParentAction(), websocketScanCommand.ParentJobID, websocketScanCommand.JobID)
184184

185-
if websocketScanCommand.ParentJobID != actionHandler.command.JobTracking.ParentID {
186-
glog.Errorf("websocket command parent: %v, child: %v, VS actionhandler.command parent: %v child %v", websocketScanCommand.ParentJobID, websocketScanCommand.JobID, actionHandler.command.JobTracking.ParentID, actionHandler.command.JobTracking.JobID)
187-
}
185+
// if websocketScanCommand.ParentJobID != actionHandler.command.JobTracking.ParentID {
186+
// glog.Errorf("websocket command parent: %v, child: %v, VS actionhandler.command parent: %v child %v", websocketScanCommand.ParentJobID, websocketScanCommand.JobID, actionHandler.command.JobTracking.ParentID, actionHandler.command.JobTracking.JobID)
187+
// }
188188
}
189189
for contIdx := range pod.Status.ContainerStatuses {
190190
if pod.Status.ContainerStatuses[contIdx].Name == containers[i].container {

notificationhandler/websocket.go

+1-1
Original file line numberDiff line numberDiff line change
@@ -105,7 +105,7 @@ func (notification *NotificationHandler) websocketReceiveNotification() error {
105105
}
106106
err := notification.handleNotification(notif)
107107
if err != nil {
108-
glog.Errorf("failed to handle notification: %s, %v,\t\t %v", messageBytes, err, notif)
108+
glog.Errorf("failed to handle notification: %s, reason: %s", messageBytes, err.Error())
109109
}
110110
case websocket.CloseMessage:
111111
return fmt.Errorf("websocket closed by server, message: %s", string(messageBytes))

notificationhandler/websocketutils.go

+38-32
Original file line numberDiff line numberDiff line change
@@ -9,10 +9,7 @@ import (
99
"time"
1010

1111
"github.com/armosec/armoapi-go/apis"
12-
"github.com/armosec/armoapi-go/armotypes"
1312
"github.com/armosec/cluster-notifier-api-go/notificationserver"
14-
opapolicy "github.com/armosec/opa-utils/reporthandling"
15-
"github.com/mitchellh/mapstructure"
1613
"gopkg.in/mgo.v2/bson"
1714

1815
"github.com/golang/glog"
@@ -54,48 +51,57 @@ func NewCommands() interface{} {
5451

5552
func parseNotificationCommand(notification interface{}) (*apis.Commands, error) {
5653
cmds := &apis.Commands{}
57-
if err := mapstructure.Decode(notification, cmds); err != nil {
58-
return nil, fmt.Errorf("parseNotificationCommand: failed to convert notification payload to commands structure")
59-
}
6054

61-
return cmds, nil
55+
var notificationBytes []byte
56+
var err error
57+
switch b := notification.(type) {
58+
case []byte:
59+
notificationBytes = b
60+
default:
61+
if notificationBytes, err = json.Marshal(notification); err != nil {
62+
return nil, fmt.Errorf("failed to marshal notification payload from command, reason: %s", err.Error())
63+
}
64+
}
65+
if err = json.Unmarshal(notificationBytes, cmds); err != nil {
66+
return nil, fmt.Errorf("failed to convert notification payload to commands structure, reason: %s", err.Error())
67+
}
68+
return cmds, err
6269
}
63-
6470
func (notification *NotificationHandler) handleNotification(notif *notificationserver.Notification) error {
6571
dst := notif.Target["dest"]
6672
switch dst {
67-
case "kubescape":
68-
// sent by this function in dash BE: KubescapeInClusterHandler
69-
policyNotificationBytes, ok := notif.Notification.([]byte)
70-
if !ok {
71-
return fmt.Errorf("handleNotification, kubescape, failed to get policyNotificationBytes")
72-
}
73-
policyNotification := &opapolicy.PolicyNotification{}
74-
if err := json.Unmarshal(policyNotificationBytes, policyNotification); err != nil {
75-
return fmt.Errorf("handleNotification, kubescape, failed to Unmarshal: %v", err)
76-
}
77-
78-
sessionOnj := cautils.NewSessionObj(&apis.Command{
79-
CommandName: string(policyNotification.NotificationType),
80-
Designators: []armotypes.PortalDesignator{policyNotification.Designators},
81-
JobTracking: apis.JobTracking{JobID: policyNotification.JobID},
82-
Args: map[string]interface{}{
83-
"kubescapeJobParams": policyNotification.KubescapeJobParams,
84-
"rules": policyNotification.Rules},
85-
}, "WebSocket", "", policyNotification.JobID, 1)
86-
*notification.sessionObj <- *sessionOnj
87-
88-
case "trigger":
73+
// case "kubescape":
74+
// // sent by this function in dash BE: KubescapeInClusterHandler
75+
// policyNotificationBytes, ok := notif.Notification.([]byte)
76+
// if !ok {
77+
// return fmt.Errorf("handleNotification, kubescape, failed to get policyNotificationBytes")
78+
// }
79+
// policyNotification := &opapolicy.PolicyNotification{}
80+
// if err := json.Unmarshal(policyNotificationBytes, policyNotification); err != nil {
81+
// return fmt.Errorf("handleNotification, kubescape, failed to Unmarshal: %v", err)
82+
// }
83+
84+
// sessionOnj := cautils.NewSessionObj(&apis.Command{
85+
// CommandName: string(policyNotification.NotificationType),
86+
// Designators: []armotypes.PortalDesignator{policyNotification.Designators},
87+
// JobTracking: apis.JobTracking{JobID: policyNotification.JobID},
88+
// Args: map[string]interface{}{
89+
// "kubescapeJobParams": policyNotification.KubescapeJobParams,
90+
// "rules": policyNotification.Rules},
91+
// }, "WebSocket", "", policyNotification.JobID, 1)
92+
// *notification.sessionObj <- *sessionOnj
93+
94+
case "trigger", "kubescape":
8995
cmds, err := parseNotificationCommand(notif.Notification)
9096
if err != nil {
9197
return err
9298
}
9399
for _, cmd := range cmds.Commands {
94-
sessionObj := cautils.NewSessionObj(&cmd, "WebSocket", "", "", 1)
100+
sessionObj := cautils.NewSessionObj(&cmd, "WebSocket", cmd.JobTracking.ParentID, cmd.JobTracking.JobID, 1)
95101
*notification.sessionObj <- *sessionObj
96102
}
97103

98-
case "", "safeMode":
104+
case "safeMode":
99105
safeMode, e := parseSafeModeNotification(notif.Notification)
100106
if e != nil {
101107
return e
+15
Original file line numberDiff line numberDiff line change
@@ -1 +1,16 @@
11
package notificationhandler
2+
3+
import (
4+
"testing"
5+
6+
"github.com/stretchr/testify/assert"
7+
)
8+
9+
var mockCommandRunKubescapeJob = `{"commands":[{"CommandName":"runKubescapeJob","responseID":"","jobTracking":{"jobID":"6be09aad-a376-4d6b-97ad-8d1a75fce89d","timestamp":"0001-01-01T00:00:00Z"},"args":{"kubescapeJobParams":{"clusterName":"dwertent","frameworkName":"DevOpsBest","jobID":"6be09aad-a376-4d6b-97ad-8d1a75fce89d"},"scanV1":{"targetNames":["DevOpsBest"],"targetType":"Framework"}},"designators":[{"designatorType":"","attributes":{"cluster":"dwertent"}}]}]}`
10+
11+
func TestParseNotificationCommand(t *testing.T) {
12+
cmd, err := parseNotificationCommand([]byte(mockCommandRunKubescapeJob))
13+
assert.NoError(t, err)
14+
assert.Equal(t, 1, len(cmd.Commands))
15+
assert.Equal(t, "runKubescapeJob", cmd.Commands[0].CommandName)
16+
}

0 commit comments

Comments
 (0)